Infostealers have become an established business, with developers who produce and maintain the product and paying customers who run their own campaigns with them. Amatera – which topped ESET’s infostealer detections in Latin America in the first half of 2026 but targets victims worldwide – shows what this professionalization looks like in practice.

Like many other infostealers, Amatera goes after a range of data spanning login credentials, session cookies, tokens, crypto wallet information, messaging data, files, and secrets from development environments. The sheer breadth of the loot shows why infostealers are a mainstay of cybercrime – a single compromise can lead to account hijacking, financial fraud and crypto theft, as well as open the door into the organization where the victim works.

Here’s more about where Amatera came from, along with its business model, capabilities, and distribution.

What is Amatera?

Detected by ESET products as Win/PSW.Amatera, Amatera is a Windows infostealer written in C++ that was first observed in 2024. Since it’s marketed under the malware-as-a-service (MaaS) model, its developers maintain the code, the control panel, and the support infrastructure, while affiliates pay a subscription to use the malware in their campaigns.

Given the similarities in their respective code, Amatera is very likely a rebrand of ACR Stealer. Indeed, the latter has a predecessor of its own: a Sekoia investigation in May 2024 described it as an updated version of the GrMsk stealer, offered as a service on underground forums.

Rebranding – or releasing an updated version of a piece of malware under a new name – is very common across the MaaS ecosystem, particularly among ransomware operators. They sometimes sell the source code when they shut down their operations to avoid being tracked, or they update and rename it as a ‘business strategy’. In some cases, they leak it so that other malicious actors can reuse it. At any rate, by the end of 2024, Amatera Stealer was already on offer for $199 a month, with support via Telegram..

amatera-infostelaer-predomina-latam-2
Figure 1. Amatera stealer being offered through subscription plans and with support via Telegram (Source: X)

Amatera’s capabilities

Amatera extracts credentials stored in web browsers, along with cookies, browsing histories, form data, and session tokens. It can also search for and grab sensitive documents and files synced with OneDrive or SharePoint – Microsoft reported a surge in attacks on its enterprise customers between late April and mid-June 2026. Separately, Straiker found that the malware also went after cryptocurrency wallet data by manipulating the clipboard.

The malware is also under constant development, and it turns up as the final payload in a wide variety of attack chains. That variety is also typical of MaaS: the developers sell the product, and each affiliate chooses their own way to deliver it.

Amatera has spread via compromised websites, search engine ads, targeted emails, fake documents, SVG files, and ClickFix via fake CAPTCHAs. Indeed, several recent analyses of Amatera campaigns worldwide show that one of its key delivery vectors is ClickFix, a social engineering technique that was first documented in 2024 and was quickly picked up by adversaries to distribute a wide range of malware families. 

amatera-infostelaer-predomina-latam-1
Figure 2. Example of a fake pop-up window prompting the victim to copy and execute an instruction on their computer and unwittingly set the compromise process into motion

Often, the victim sees a message that mimics a CAPTCHA check or a browser error and warns them of supposed technical problems that can be fixed by copying a command and running it on their computer. The victim’s own keystrokes then set the compromise in motion. The technique has moved beyond fake CAPTCHAs, however, as adversaries kept the social engineering core of ClickFix with some tweaks:

· AI-fix: Attackers build pages that impersonate legitimate AI services, including Anthropic’s Artifacts, OpenAI’s Canvas, and Microsoft Copilot Pages. The pages contain fake troubleshooting content for non-existent problems.

· CrashFix: A fake ad blocker triggers fake browser crashes and warns of data loss, pushing victims toward a malicious “quick fix.”

· ConsentFix: This variant tricks the victims into handing over their OAuth authorization tokens that open their Microsoft accounts to attackers without any password being stolen.

ClickFix-based campaigns have also used legitimate but compromised WordPress sites, among other methods. Attackers gained access to these sites through weak or stolen administrative credentials or by exploiting vulnerabilities in WordPress themes and plugins.

In Latin America, Amatera topped ESET’s infostealer detections in the first half of 2026, ahead of Formbook, Vidar, Lumma Stealer, SnakeStealer, and Rhadamanthys. ClickFix’s recent growth globally hasn’t been a straight line, however. ESET detections jumped by more than 500% in the first half of 2025 compared with the previous six months, making it the second most common attack vector after phishing. Detections fell steeply in the second half of 2025, before more than doubling in the first half of 2026 as attackers adapted the technique to new environments. 

amatera-figure-3
Figure 3. ClickFix detection trend in H2 2025–H1 2026, seven-day moving average (source: ESET Threat Report H1 2026)

Amatera’s affiliates also buy Google ads. The Straiker research mentioned above uncovered dozens of fake install pages that were promoted through paid ads and SEO poisoning and impersonated AI and developer tools, such as Claude Code, NotebookLM, JetBrains, Comet, and Snowflake, and specifically targeted developers who use AI tools. Like AI-fix, these pages piggyback off the credibility of AI brands and share the execution chain with ClickFix.

amatera-figure-4
Figure 4. Amatera detections in Latin America in the first half of 2026

Risks and consequences of an Amatera compromise

Based on its capabilities, these are some of the potential consequences of falling victim to Amatera:

  • Compromise of personal or corporate accounts through stolen passwords, cookies, and tokens
  • Unauthorized access to email and cloud storage
  • Theft of crypto assets when wallets or recovery phrases are exposed
  • Infrastructure compromise through SSH keys, FTP credentials, or development secrets
  • Installation of additional malware
  • Use of a compromised account for fraud, internal phishing campaigns, or further intrusions

The risk spills over to employers when the victim mixes personal and work profiles in the same web browser. A home computer may hold corporate email sessions, cloud consoles, code repositories, or HR systems. The stolen information eventually becomes a gateway that another actor can buy or exploit days later.

How to prevent and respond to an Amatera compromise

Here are a few tips for staying out of harm’s way, especially in corporate environments:

  • Remember that no legitimate CAPTCHA, error message, or installation guide will ask you to copy commands from a web page into the Run dialog, PowerShell, or Terminal. A search engine ad is no guarantee that a site is official. That applies equally to pages that look like they belong to a well-known AI service.
  • Enforce application control rules and reduce the attack surface by limiting the use of system interpreters and binaries outside their normal context.
  • Monitor PowerShell, Rundll32, WebDAV, unusual scheduled tasks, and the clearing of PowerShell history.
  • Use phishing-resistant authentication and keep browser sessions as short as business needs allow.
  • Separate personal and work profiles, and avoid storing secrets in the browser when a managed alternative is available.
  • Filter newly created sites, cloned installation pages, and downloads initiated from ads when the context doesn’t justify them.

If a compromise is confirmed, isolating the device is only the first step. From a trusted device, revoke active sessions, reset passwords, and rotate API keys, tokens, SSH credentials, and any other secrets present on the system. Also, review access to email, cloud services, repositories, and financial applications. The response must track follow-on activity, rather than stop at the initial host – documented campaigns executed additional payloads, created scheduled tasks, covered their tracks, and used legitimate system tools.

Conclusion

Amatera shows how the infostealer market works today. A developer maintains the product, and other actors distribute it via compromised websites, ads, fake AI tools, emails, or ClickFix instructions. The threat can outlive the malicious file itself, however, as passwords, cookies, session tokens, and confidential documents remain valuable even after the device has been cleaned. Stolen data can fuel both immediate fraud or later intrusions, and the rise in detections in 2026 shows attackers adopting and adapting malicious toolsets at a rapid clip.